This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: [email protected]

Comparison

All 33

No Change 31

Updated 2

Added 0

Removed 0

V-69715
No Change

Findings ID:

EX13-CA-000005

Rule ID:

SV-84337r1_rule

Severity:

medium

CCI:

CCI-000068

Discussion

This setting controls whether client machines are forced to use secure channels to communicate with the server. If this feature is enabled, clients will only be able to communicate with the server over secure communication channels.

Failure to require secure connections to the client access server increases the potential for unintended eavesdropping or data loss.

Checks

Open the Exchange Management Shell and enter the following command:

Get-RpcClientAccess | Select Server, Name, EncryptionRequired

If the value of EncryptionRequired is not set to True, this is a finding.

Fix

Open the Exchange Management Shell and enter the following command:

Set-RpcClientAccess -Server <ServerName> -EncryptionRequired $true

V-69717
No Change

Findings ID:

EX13-CA-000010

Rule ID:

SV-84339r1_rule

Severity:

medium

CCI:

CCI-000068

Discussion

This setting controls whether client machines should be forced to use secure channels to communicate with this virtual directory. If this feature is enabled, clients will only be able to communicate with the directory if they are capable of supporting secure communication with the server.

The use of secure communication prevents eavesdroppers from reading or modifying communications between servers and clients. The network and DMZ STIG identify criteria for OWA and Public Folder configuration in the network, including CAC enabled pre-authentication through an application firewall proxy.

Failure to require secure connections on a web site increases the potential for unintended eavesdropping or data loss.

Fix

Configure the OWA site to require SSL port 443.

V-69719
Updated

Findings ID:

EX13-CA-000015

Rule ID:

SV-84341r12_rule

Severity:

medium

CCI:

CCI-000068

Discussion

Identification and Authentication provide the foundation for access control. Access to email services applications in the DoD requires authentication using DoD Public Key Infrastructure (PKI) certificates. Authentication for Outlook Web App (OWA) is used to enable web access to user email mailboxes and should assume that certificate-based authentication has been configured. This setting controls whether forms-based logon should be used by the OWA website.

Because the DoD requires Common Access Card (CAC)-based authentication to applications, OWA access must be brokered through an application proxy or other pre-authenticator, which performs CAC authentication prior to arrival at the CA server. The authenticated request is then forwarded directly to OWA, where authentication is repeated without requiring the user to repeat authentication steps. For this scenario to work, the Application Proxy server must have forms-based authentication enabled, and Exchange must have forms-based Authentication disabled.

If forms-based Authentication is enabled on the Exchange CA server, it is evidence that the application proxy server is either not correctly configured, or it may be missing.

Discussion

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., networks, web servers, and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.

Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system.

This requirement is applicable to access control enforcement applications (e.g., authentication servers) and other applications that perform information and system access control functions.

Discussion

Unauthorized or malicious data changes can compromise the integrity and usefulness of the data. Automated attacks or malicious users with elevated privileges have the ability to affect change using the same mechanisms as email administrators.

Auditing changes to access mechanisms not only supports accountability and non-repudiation for those authorized to define the environment but also enables investigation of changes made by others who may not be authorized.

Note: This administrator auditing feature audits all exchange changes regardless of the users' assigned role or permissions.

Checks

Open the Exchange Management Shell and enter the following command:

Get-AdminAuditLogConfig | Select Name, Identity, AdminAuditLogEnabled

If the value of AdminAuditLogEnabled is not set to True, this is a finding.

Fix

Open the Exchange Management Shell and enter the following command:

Set-AdminAuditLogConfig -AdminAuditLogEnabled $true

V-69725
No Change

Findings ID:

EX13-CA-000030

Rule ID:

SV-84347r1_rule

Severity:

medium

CCI:

CCI-000213

Discussion

Server certificates are required for many security features in Exchange; without them the server cannot engage in many forms of secure communication. Failure to implement valid certificates makes it virtually impossible to secure Exchange's communications.

Checks

Open the Exchange Management Shell and enter the following command:

Get-ExchangeCertificate | Select CertificateDomains, issuer

If the value of CertificateDomains does not indicate it is issued by the DoD, this is a finding.

Fix

Remove the non-DoD certificate and import the correct DoD certificates.

V-69727
No Change

Findings ID:

EX13-CA-000035

Rule ID:

SV-84349r1_rule

Severity:

medium

CCI:

CCI-000213

Discussion

Identification and Authentication provide the foundation for access control. For EAS to be used effectively on DoD networks, client certificate authentication must be used for communications between the MEM and email server. Additionally, the internal and external URLs must be set to the same address, since all EAS traffic must be tunneled to the device from the MEM.

The risk associated with email synchronization with CMD should be mitigated by the introduction of MEM products and is specified in the DoD CIO memo dated 06 Apr 2011. The memo states specifically, "Email redirection from the email server (e.g., Exchange Server) to the device shall be controlled via centrally managed server." When EAS is used on DoD networks, the devices must be managed by an MEM.

Note: The <ServerName>Microsoft-Server-ActiveSync (Default Web Site) value must be in quotes.

V-69729
No Change

Findings ID:

EX13-CA-000040

Rule ID:

SV-84351r1_rule

Severity:

medium

CCI:

CCI-000213

Discussion

For EAS to be used effectively on DoD networks, client certificate authentication must be used for communications between the MEM and email server. Identification and Authentication provide the foundation for access control. IIS must be mapped to an approved certificate server for client certificates. Additionally, the internal and external URLs must be set to the same address, since all EAS traffic must be tunneled to the device from the MEM.

The risk associated with email synchronization with CMD should be mitigated by the introduction of MEM products and is specified in the DoD CIO memo dated 06 Apr 2011. The memo states specifically, "Email redirection from the email server (e.g., Exchange Server) to the device shall be controlled via centrally managed server." When EAS is used on DoD networks, the devices must be managed by an MEM.

Discussion

Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Diagnostic logging, however, characteristically produces large volumes of data and requires care in managing the logs to prevent risk of disk capacity denial of service conditions.

Exchange diagnostic logging is broken up into 29 main "services", each of which has anywhere from 2 to 26 "categories" of events to be monitored. Moreover, each category may be set to one of four levels of logging: Lowest, Low, Medium, and High, depending on how much detail one desires. The higher the level of detail, the more disk space required to store the audit material.

Diagnostic logging is intended to help administrators debug problems with their systems, not as a general purpose auditing tool. Because the diagnostic logs collect a great deal of information, the log files may grow large very quickly. Diagnostic log levels may be raised for limited periods of time when attempting to debug relevant pieces of Exchange functionality. Once debugging has finished, diagnostic log levels should be reduced again.

Checks

Open the Exchange Management Shell and enter the following command:

Get-EventLogLevel

If any Diagnostic EventLogLevel is not set to Lowest, this is a finding.

Discussion

Log files help establish a history of activities, and can be useful in detecting attack attempts. This item declares the fields that must be available in the audit log file in order to adequately research events that are logged.

Checks

If the value of AdminAuditLogParameters is not set to {*}, this is a finding.

Note: The value of {*} indicates all parameters are being audited.

Fix

Open the Exchange Management Shell and enter the following command:

Set-AdminAuditLogConfig -AdminAuditLogParameters *

V-69735
No Change

Findings ID:

EX13-CA-000055

Rule ID:

SV-84357r1_rule

Severity:

medium

CCI:

CCI-000154

Discussion

Monitors are automated "process watchers" that respond to performance changes, and can be useful in detecting outages and alerting administrators where attention is needed. Exchange has built-in monitors that enable the administrator to generate alerts if thresholds are reached, better enabling them to react in a timely fashion.

This field offers choices of alerts when a "warning" or "critical" threshold is reached on the SMTP queue. A good rule of thumb (default) is to issue warnings when SMTP queue growth exceeds 10 minutes and critical messages when it exceeds 20 minutes, which should only exist occasionally. Frequent alerts against this counter may indicate a network or other issue (such as inbound SPAMMER traffic) that directly impacts email delivery.

Notification choices include email alert to an email-enabled account, for example, an email Administrator, or invoke a script to take other action, for example, to add an Event to the Microsoft Application Event Log, where external monitors might detect it.

Checks

Note: If a third-party application is performing monitoring functions, the reviewer should verify the application is monitoring correctly and mark the vulnerability not applicable.

If no sets are defined or queues are not being monitored, this is a finding.

Fix

Open the Exchange Management Shell and enter the following command:

perfmon

In the left pane, navigate to and select Performance >> Data Collector Sets >> User Defined.

Right-click, navigate to, and configure User Defined >> New >> Data Collector Set to use user-defined data collection for monitoring the queues.

V-69737
No Change

Findings ID:

EX13-CA-000060

Rule ID:

SV-84359r1_rule

Severity:

medium

CCI:

CCI-000381

Discussion

Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. This setting enables an automated log entry to be sent to Microsoft giving general details about the nature and location of the error. Microsoft, in turn, uses this information to improve the robustness of their product.

While this type of debugging information would not ordinarily contain sensitive information, it may alert eavesdroppers to the existence of problems in your Exchange organization. At the very least, it could alert them to (possibly) advantageous timing to mount an attack. At worst, it may provide them with information as to which aspects of Exchange are causing problems and might be vulnerable (or at least sensitive) to attack.

All system errors in Exchange will result in outbound traffic that may be identified by an eavesdropper. For this reason, the "Report Fatal Errors to Microsoft" feature must be disabled.

Discussion

Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit log content must always be considered sensitive, and in need of protection. Audit data available for modification by a malicious user can be altered to conceal malicious activity. Audit data might also provide a means for the malicious user to plan unauthorized activities that exploit weaknesses.

The contents of audit logs are protected against unauthorized access, modification, or deletion. Only authorized auditors and the audit functions should be granted Read and Write access to audit log data.

Checks

Review the Email Domain Security Plan (EDSP).

Determine the authorized groups or users that should have read access to the audit data.

If any group or user has read access to the audit data that is not documented in the EDSP, this is a finding.

Fix

Update the EDSP.

Navigate to the location of the audit data.

Restrict any unauthorized groups' or users' read access to the audit logs.

V-69741
No Change

Findings ID:

EX13-CA-000070

Rule ID:

SV-84363r1_rule

Severity:

medium

CCI:

CCI-000381

Discussion

It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors.

Applications are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions).

Examples of non-essential capabilities include, but are not limited to, advertising software or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission, but cannot be disabled.

Checks

If the value for CustomerFeedbackEnabled is not set to False, this is a finding.

Fix

Open the Exchange Management Shell and enter the following command:

Set-OrganizationConfig -CustomerFeedbackEnabled $false

V-69743
No Change

Findings ID:

EX13-CA-000075

Rule ID:

SV-84365r1_rule

Severity:

medium

CCI:

CCI-000163

Discussion

Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit log content must always be considered sensitive, and in need of protection. Audit data available for modification by a malicious user can be altered to conceal malicious activity. Audit data might also provide a means for the malicious user to plan unauthorized activities that exploit weaknesses.

The contents of audit logs are protected against unauthorized access, modification, or deletion. Only authorized auditors and the audit functions should be granted Read and Write access to audit log data.

Checks

Review the Email Domain Security Plan (EDSP).

Determine the authorized groups or users that should have access to the audit data.

If any group or user has modify privileges for the audit data that is not documented in the EDSP, this is a finding.

Fix

Update the EDSP.

Navigate to the location of the audit data.

Restrict any unauthorized groups' or users' modify permissions for the audit logs.

V-69745
No Change

Findings ID:

EX13-CA-000080

Rule ID:

SV-84367r1_rule

Severity:

medium

CCI:

CCI-000164

Discussion

Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit log content must always be considered sensitive, and in need of protection. Audit data available for modification by a malicious user can be altered to conceal malicious activity. Audit data might also provide a means for the malicious user to plan unauthorized activities that exploit weaknesses.

The contents of audit logs are protected against unauthorized access, modification, or deletion. Only authorized auditors and the audit functions should be granted Read and Write access to audit log data.

Checks

Review the Email Domain Security Plan (EDSP).

Determine the authorized groups or users that should have delete permissions for the audit data.

If any group or user has delete permissions for the audit data that is not documented in the EDSP, this is a finding.

Fix

Update the EDSP.

Navigate to the location of the audit data.

Restrict any unauthorized groups' or users' delete permissions for the audit logs.

V-69747
No Change

Findings ID:

EX13-CA-000085

Rule ID:

SV-84369r1_rule

Severity:

low

CCI:

CCI-001348

Discussion

Log files help establish a history of activities, and can be useful in detecting attack attempts or determining tuning adjustments to improve availability. Audit log content must always be considered sensitive, and in need of protection.

Successful exploit of an application server vulnerability may well be logged by monitoring or audit processes when it occurs. By writing log and audit data to a separate partition where separate security contexts protect them, it may offer the ability to protect this information from being modified or removed by the exploit mechanism.

Checks

Review the Email Domain Security Plan (EDSP).

Determine the audit logs' assigned partition.

Note: By default, the logs are located on the application partition in \Program Files\Microsoft\Exchange Server\V15\Logging.

If the log files are not on a separate partition from the application, this is a finding.

Fix

Update the EDSP.

Configure the audit log location to be on a partition drive separate from the application.

V-69751
No Change

Findings ID:

EX13-CA-000090

Rule ID:

SV-84373r1_rule

Severity:

medium

CCI:

CCI-001749

Discussion

Scripts often provide a way for attackers to infiltrate a system, especially those downloaded from untrusted locations. By setting machine policy to prevent unauthorized script executions, unanticipated system impacts can be avoided. Failure to allow only signed remote scripts reduces the attack vector vulnerabilities from unsigned remote scripts.

Checks

Open the Exchange Management Shell and enter the following command:

Get-ExecutionPolicy

If the value returned is not RemoteSigned, this is a finding.

Fix

Open the Exchange Management Shell and enter the following command:

Set-ExecutionPolicy RemoteSigned

V-69753
No Change

Findings ID:

EX13-CA-000095

Rule ID:

SV-84375r1_rule

Severity:

medium

CCI:

CCI-000381

Discussion

The IMAP4 protocol is not approved for use within the DoD. It uses a clear text-based user name and password and does not support the DoD standard for PKI for email access. User name and password could easily be captured from the network, allowing malicious users to access other system features. Uninstalling or disabling the service will prevent the use of the IMAP4 protocol.

Checks

Note: The hklm:\system\currentcontrolset\services\MSExchangeIMAP4 value must be in quotes.

If the value of Start is not set to 4, this is a finding.

Fix

Open the Windows PowerShell and enter the following command:

services.msc

Navigate to and double-click on Microsoft Exchange IMAP4 Backend.

Click on the General tab.

In the Startup Type: dropdown, select Disabled.

Click the OK button.

V-69755
No Change

Findings ID:

EX13-CA-000100

Rule ID:

SV-84377r1_rule

Severity:

medium

CCI:

CCI-000381

Discussion

The POP3 protocol is not approved for use within the DoD. It uses a clear text based user name and password and does not support the DoD standard for PKI for email access. User name and password could easily be captured from the network allowing malicious users to access other system features. Uninstalling or disabling the service will prevent the use of the POP3 protocol.

Checks

Note: The hklm:\system\currentcontrolset\services\MSExchangePOP3 value must be in quotes.

If the value of Start is not set to 4, this is a finding.

Fix

Open the Windows PowerShell and enter the following command:

services.msc

Navigate to and double-click on Microsoft Exchange POP3 Backend.

Click on the General tab.

In the Startup Type: dropdown, select Disabled.

Click the OK button.

V-69757
No Change

Findings ID:

EX13-CA-000105

Rule ID:

SV-84379r1_rule

Severity:

low

CCI:

CCI-000381

Discussion

To reduce the vectors through which a server can be attacked, unneeded application components should be disabled or removed.

By default, a virtual directory is installed for Public Folders. If an attacker were to intrude into an Exchange CA server and be able to access the Public Folder website, it would provide an additional attack vector, provided the virtual directory was present.

Once removed, the Public functionality cannot be used without restoring the virtual directory.

Checks

Review the Email Domain Security Plan (EDSP).

Determine if public folders are being used.

Open the Exchange Management Shell and enter the following command:

Get-PublicFolder | Select Name, Identity

Note: The value returns a root directory and subdirectories.

If public folders are not in use and directories exist or are being used and are not documented in the EDSP, this is a finding.

Fix

Open the Exchange Management Shell and enter the following command:

Remove-PublicFolder -Identity 'IdentityName' -Recurse:$True

Note: This command deletes the public folder Directory Folder and all its child public folders.

V-69759
No Change

Findings ID:

EX13-CA-000110

Rule ID:

SV-84381r1_rule

Severity:

low

CCI:

CCI-000381

Discussion

To reduce the vectors through which a server can be attacked, unneeded application components should be disabled or removed. By default, a virtual directory is installed for Active Sync, and the Exchange application default has Active Sync disabled.

If an attacker were to intrude into an Exchange CA server and reactivate Active Sync, this attack vector could once again be open, provided the virtual directory is present.

Once removed, the Active Sync functionality cannot be used without restoring the virtual directory, not a trivial process.

Checks

Open the Exchange Management Shell and enter the following command:

Get-ActiveSyncVirtualDirectory | Select Server, Name, Identity, Path

If the value of Path (the actual directory path) exists, this is a finding.

Discussion

Default product installations may provide more generous access permissions than are necessary to run the application. By examining and tailoring access permissions to more closely provide the least amount of privilege possible, attack vectors that align with user permissions are less likely to access more highly secured areas.

Checks

Review the Email Domain Security Plan (EDSP).

Determine the authorized groups and users that have access to the Exchange application directories.

Verify the access permissions on the directory match the access permissions listed in the EDSP.

If any group or user has different access permissions than those listed in the EDSP, this is a finding.

Fix

Update the EDSP.

Remove or modify the group or user access permissions.

V-69763
No Change

Findings ID:

EX13-CA-000120

Rule ID:

SV-84385r1_rule

Severity:

medium

CCI:

CCI-001813

Discussion

Exchange software, as with other application software installed on a host system, must be included in a system baseline record and periodically reviewed; otherwise, unauthorized changes to the software may not be discovered. This effort is a vital step to securing the host and the applications, as it is the only method that may provide the ability to detect and recover from otherwise undetected changes, such as those that result from worm or bot intrusions.

The Exchange software and configuration baseline is created and maintained for comparison during scanning efforts. Operational procedures must include baseline updates as part of configuration management tasks that change the software and configuration.

Checks

Note the list of files and directories included in the baseline procedure for completeness.

If an email software copy exists to serve as a baseline and is available for comparison during scanning efforts, this is not a finding.

Fix

Update the EDSP.

Implement the email software baseline process.

V-69765
No Change

Findings ID:

EX13-CA-000125

Rule ID:

SV-84387r1_rule

Severity:

medium

CCI:

CCI-001814

Discussion

Monitoring software files for changes against a baseline on a regular basis may help detect the possible introduction of malicious code on a system.

Checks

Review the Email Domain Security Plan (EDSP).

Determine whether the site monitors system files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) on servers for unauthorized changes against a baseline on a weekly basis.

If software files are not monitored for unauthorized changes on a weekly basis, this is a finding.

Note: A properly configured HBSS Policy Auditor File Integrity Monitor (FIM) module will meet the requirement for file integrity checking. The Asset module within HBSS does not meet this requirement.

Fix

Update the EDSP.

Monitor the software files (e.g., *.exe, *.bat, *.com, *.cmd, and *.dll) on Exchange servers for unauthorized changes against a baseline on a weekly basis.

Use an approved DoD monitoring tool.

V-69767
No Change

Findings ID:

EX13-CA-000130

Rule ID:

SV-84389r1_rule

Severity:

medium

CCI:

CCI-001762

Discussion

Unneeded but running services offer attackers an enhanced attack profile, and attackers are constantly watching to discover open ports with running services. By analyzing and disabling unneeded services, the associated open ports become unresponsive to outside queries, and servers become more secure as a result.

For example, a server implemented in the Client Access role (i.e., Outlook Web App [OWA]) is configured and tuned as a web server using web protocols. A client access server exposes only web protocols (HTTP/HTTPS), enabling system administrators to optimize the protocol path and disable all services unnecessary for Exchange web services. Similarly, servers created to host mailboxes are dedicated to that task and must operate only the services needed for mailbox hosting. (Exchange servers must also operate some Web services, but only to the degree that Exchange requires the IIS engine in order to function).

Because POP3 and IMAP4 clients are not included in the standard desktop offering, they must be disabled.

Checks

Review the Email Domain Security Plan (EDSP).

Note: Required services will vary between organizations and will vary depending on the role of the individual system. Organizations will develop their own list of services, which will be documented and justified with the ISSO. The site’s list will be provided for any security review. Services that are common to multiple systems can be addressed in one document. Exceptions for individual systems should be identified separately by system.

Open a Windows PowerShell and enter the following command:

Get-Service | Where-Object {$_.status -eq 'running'}

The command returns a list of installed services and the status of that service.

If the site has not documented the services required for its system(s), this is a finding.

If any undocumented or unnecessary services are running, this is a finding.

Fix

Update the EDSP with the services required for the system to function.

Remove or disable any services that are not required.

V-69769
No Change

Findings ID:

EX13-CA-000135

Rule ID:

SV-84391r1_rule

Severity:

medium

CCI:

CCI-001953

Discussion

Identification and authentication provide the foundation for access control. Access to email services applications requires NTLM authentication. Outlook Anywhere, if authorized for use by the site, must use NTLM authentication when accessing email.

Note: There is a technical restriction in Exchange OA that requires a direct SSL connection from Outlook to the CA server. There is also a constraint where Microsoft supports that the CA server must participate in the AD domain inside the enclave. For this reason, Outlook Anywhere must be deployed only for enclave-sourced Outlook users.

Discussion

In the same way that added security layers can provide a cumulative positive effect on security posture, multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of other applications sharing the same security context. For example, an exploit to a web server process that leads to unauthorized administrative access to the host system can most likely lead to a compromise of all applications hosted by the same system.

Email services should be installed on a partition that does not host other applications. Email services should never be installed on a Domain Controller/Directory Services server.

Checks

Review the Email Domain Security Plan (EDSP).

Determine where the directory Exchange is installed.

Open Windows Explorer.

Navigate to the directory or partition where Exchange is installed.

If Exchange resides on a directory or partition other than that of the OS and does not have other applications installed (unless approved by the ISSO), this is not a finding.

Fix

Update the EDSP.

Install Exchange on a dedicated application directory or partition separate than that of the OS.

V-69773
No Change

Findings ID:

EX13-CA-000145

Rule ID:

SV-84395r1_rule

Severity:

medium

CCI:

CCI-002385

Discussion

Load balancing is a way to manage which Exchange servers receive traffic. Load balancing helps distribute incoming client connections over a variety of endpoints. This ensures that no one endpoint takes on a disproportional share of the load. Load balancing provides failover redundancy in case one or more endpoints fails. By using load balancing, users continue to receive Exchange service in case of a computer failure. Load balancing also enables Exchange to handle more traffic than one server can process while offering a single host name for your clients.

Checks

Review the Email Domain Security Plan (EDSP).

Determine if the Exchange Servers are using redundancy.

Get-ClientAccessServer | Select Name, Site

If the value returned is not at least two CAS servers, this is a finding.

Fix

Update the EDSP.

Configure two or more CAS servers for load balancing.

V-69775
No Change

Findings ID:

EX13-CA-000150

Rule ID:

SV-84397r1_rule

Severity:

high

CCI:

CCI-002418

Discussion

Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered.

Fix

Note: The <IdentityName>\owa (default web site) value must be in quotes.

V-69777
No Change

Findings ID:

EX13-CA-000155

Rule ID:

SV-84399r1_rule

Severity:

medium

CCI:

CCI-002421

Discussion

Without protection of the transmitted information, confidentiality and integrity may be compromised since unprotected communications can be intercepted and either read or altered.

This requirement applies only to those applications that are either distributed or can allow access to data non-locally. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process. When transmitting data, applications need to leverage transmission protection mechanisms, such as TLS, SSL VPNs, or IPsec.

Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification.

Fix

Note: The <ServerName>\owa (Default Web Site) value must be in quotes.

V-69779
No Change

Findings ID:

EX13-CA-000160

Rule ID:

SV-84401r1_rule

Severity:

medium

CCI:

CCI-002605

Discussion

Failure to install the most current Exchange service pack leaves a system vulnerable to exploitation. Current service packs correct known security and system vulnerabilities.

Checks

Determine the most current, approved service pack.

Open the Exchange Management Shell and enter the following command:

Get-ExchangeServer | fl Name, AdminDisplayVersion

If the value of AdminDisplayVersion does not return the most current, approved service pack, this is a finding.

Fix

Install the most current, approved service pack.

V-69781
Updated

Findings ID:

EX13-CA-000165

Rule ID:

SV-84403r12_rule

Severity:

medium

CCI:

CCI-000366

Discussion

Configuring the application to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements.

Configuration settings are the set of parameters that can be changed that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the application, including the parameters required to satisfy other security control requirements.

Checks

Open a Windows PowerShell Module and enter the following commands:

Get-Website | Select Name

Get-WebBinding -Name <'WebSiteName'> | Format-List

If the Web binding values returned are not on standard port 80 and 81 for HTTP connections or port 443 and 444 for HTTPS connections, this is a finding.

Repeat the process for each website.

Fix

Configure web ports to be ports 8080, 81 and 443, 444, as specified by PPSM standards.